chore: production deploy

.bun-version

@@ -1 +1 @@
-1.4.1
+1.4.2

.gitattributes

@@ -26,6 +26,7 @@ apps/cli-go/api/v1-openapi.yaml linguist-generated=true
 apps/cli-go/pkg/api/*.gen.go linguist-generated=true
 packages/api/src/generated/* linguist-generated=true
 packages/api/scripts/openapi-source.json linguist-generated=true
+packages/stack/src/functions/generated/* text eol=lf linguist-generated=true
 apps/cli/src/shared/feedback/database.types.ts linguist-generated=true
 apps/docs/public/cli/config.schema.json linguist-generated=true
 apps/docs/public/cli/project-config.schema.json linguist-generated=true

.github/actions/setup/action.yml

@@ -14,6 +14,12 @@ inputs:
       fails with a path validation error.
     required: false
     default: "true"
+  go-cache:
+    description: >-
+      Whether to restore the Go module and build caches. Disable this in jobs
+      that never run Go.
+    required: false
+    default: "true"
 
 runs:
   using: "composite"
@@ -52,16 +58,33 @@ runs:
         restore-keys: |
           pnpm-store-files-${{ runner.os }}-${{ runner.arch }}-
 
-    - name: Resolve Go cache paths
+    - name: Resolve pnpm cache path
+      if: inputs.dependency-cache == 'true'
+      id: pnpm-cache
+      shell: bash
+      run: echo "path=$(pnpm cache path --silent)" >> "$GITHUB_OUTPUT"
+
+    # pnpm stores the lockfile's supply-chain verdict in lockfile-verified.jsonl;
+    # without it every job re-verifies all entries against registry metadata,
+    # which dominates a warm-store install. The verdict is bound to the policy
+    # and to the registry it was checked against.
+    - name: Configure pnpm verification cache
       if: inputs.dependency-cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.pnpm-cache.outputs.path }}/lockfile-verified.jsonl
+        key: pnpm-verify-${{ runner.os }}-${{ inputs.dependency-firewall-token != '' && 'firewall' || 'public' }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
+
+    - name: Resolve Go cache paths
+      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true'
       id: go-cache
       shell: bash
       run: |
         echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
         echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
 
     - name: Configure Go dependency cache
-      if: inputs.dependency-cache == 'true'
+      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true'
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |

.github/dependabot.yml

@@ -85,11 +85,26 @@ updates:
         update-types:
           - minor
           - patch
+    # These lines are generated from packages/stack/src/Artifacts.ts (the single version table
+    # for slim-capable services); updates to them arrive through slim-release-published.yml, not
+    # Dependabot. Kong and pg14 (supabase/postgres) have no slim build either, but are bumped by
+    # hand, not by Dependabot. Dependabot keeps bumping only the images that remain genuinely
+    # upstream-only: migra, pg_prove, pgadmin-schema-diff.
     ignore:
       - dependency-name: "library/kong"
       - dependency-name: "axllent/mailpit"
       - dependency-name: "darthsim/imgproxy"
       - dependency-name: "timberio/vector"
+      - dependency-name: "supabase/postgres"
+      - dependency-name: "supabase/gotrue"
+      - dependency-name: "postgrest/postgrest"
+      - dependency-name: "supabase/realtime"
+      - dependency-name: "supabase/storage-api"
+      - dependency-name: "supabase/edge-runtime"
+      - dependency-name: "supabase/studio"
+      - dependency-name: "supabase/postgres-meta"
+      - dependency-name: "supabase/logflare"
+      - dependency-name: "supabase/supavisor"
     cooldown:
       default-days: 7
       exclude:

.github/scripts/slim-mirror-payload.ts

@@ -4,7 +4,7 @@
  */
 
 const SERVICE_PATTERN = /^[a-z][a-z0-9-]*$/;
-export const VERSION_PATTERN = /^[A-Za-z0-9._-]+$/;
+const VERSION_PATTERN = /^[A-Za-z0-9._-]+$/;
 export const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
 
 export const SOURCE_REGISTRY = "ghcr.io/supabase/cli";